You are here
Home > Preporuke > Sigurnosni nedostaci programskog paketa systemd

Sigurnosni nedostaci programskog paketa systemd

openSUSE Security Update: Security update for systemd
______________________________________________________________________________

Announcement ID: openSUSE-SU-2018:3803-1
Rating: important
References: #1106923 #1108835 #1109252 #1110445 #1111278
#1112024 #1113083 #1113632 #1113665
Cross-References: CVE-2018-15686 CVE-2018-15688
Affected Products:
openSUSE Leap 42.3
______________________________________________________________________________

An update that solves two vulnerabilities and has 7 fixes
is now available.

Description:

This update for systemd fixes the following issues:

Security issues fixed:

– CVE-2018-15688: A buffer overflow vulnerability in the dhcp6 client of
systemd allowed a malicious dhcp6 server to overwrite heap memory in
systemd-networkd. (bsc#1113632)
– CVE-2018-15686: A vulnerability in unit_deserialize of systemd allows an
attacker to supply arbitrary state across systemd re-execution via
NotifyAccess. This can be used to improperly influence systemd execution
and possibly lead to root privilege escalation. (bsc#1113665)

Non-security issues fixed:

– dhcp6: split assert_return() to be more debuggable when hit
– core: skip unit deserialization and move to the next one when
unit_deserialize() fails
– core: properly handle deserialization of unknown unit types (#6476)
– core: don’t create Requires for workdir if “missing ok” (bsc#1113083)
– logind: use manager_get_user_by_pid() where appropriate
– logind: rework manager_get_{user|session}_by_pid() a bit
– login: fix user@.service case, so we don’t allow nested sessions (#8051)
(bsc#1112024)
– core: be more defensive if we can’t determine per-connection socket peer
(#7329)
– socket-util: introduce port argument in sockaddr_port()
– service: fixup ExecStop for socket-activated shutdown (#4120)
– service: Continue shutdown on socket activated unit on termination
(#4108) (bsc#1106923)
– cryptsetup: build fixes for “add support for sector-size= option”
– udev-rules: IMPORT cmdline does not recognize keys with similar names
(bsc#1111278)
– core: keep the kernel coredump defaults when systemd-coredump is disabled
– core: shorten main() a bit, split out coredump initialization
– core: set RLIMIT_CORE to unlimited by default (bsc#1108835)
– core/mount: fstype may be NULL
– journald: don’t ship systemd-journald-audit.socket (bsc#1109252)
– core: make “tmpfs” dependencies on swapfs a “default” dep, not an
“implicit” (bsc#1110445)
– mount: make sure we unmount tmpfs mounts before we deactivate swaps
(#7076)
– tmp.mount.hm4: After swap.target (#3087)

– Ship systemd-sysv-install helper via the main package This script was
part of systemd-sysvinit sub-package but it was wrong since
systemd-sysv-install is a script used to redirect enable/disable
operations to chkconfig when the unit targets are sysv init scripts.
Therefore it’s never been a SySV init tool.

This update was imported from the SUSE:SLE-12-SP2:Update update project.

Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or “zypper patch”.

Alternatively you can run the command listed for your product:

– openSUSE Leap 42.3:

zypper in -t patch openSUSE-2018-1423=1

Package List:

– openSUSE Leap 42.3 (i586 x86_64):

libsystemd0-228-62.1
libsystemd0-debuginfo-228-62.1
libsystemd0-mini-228-62.1
libsystemd0-mini-debuginfo-228-62.1
libudev-devel-228-62.1
libudev-mini-devel-228-62.1
libudev-mini1-228-62.1
libudev-mini1-debuginfo-228-62.1
libudev1-228-62.1
libudev1-debuginfo-228-62.1
nss-myhostname-228-62.1
nss-myhostname-debuginfo-228-62.1
nss-mymachines-228-62.1
nss-mymachines-debuginfo-228-62.1
systemd-228-62.1
systemd-debuginfo-228-62.1
systemd-debugsource-228-62.1
systemd-devel-228-62.1
systemd-logger-228-62.1
systemd-mini-228-62.1
systemd-mini-debuginfo-228-62.1
systemd-mini-debugsource-228-62.1
systemd-mini-devel-228-62.1
systemd-mini-sysvinit-228-62.1
systemd-sysvinit-228-62.1
udev-228-62.1
udev-debuginfo-228-62.1
udev-mini-228-62.1
udev-mini-debuginfo-228-62.1

– openSUSE Leap 42.3 (x86_64):

libsystemd0-32bit-228-62.1
libsystemd0-debuginfo-32bit-228-62.1
libudev1-32bit-228-62.1
libudev1-debuginfo-32bit-228-62.1
nss-myhostname-32bit-228-62.1
nss-myhostname-debuginfo-32bit-228-62.1
systemd-32bit-228-62.1
systemd-debuginfo-32bit-228-62.1

– openSUSE Leap 42.3 (noarch):

systemd-bash-completion-228-62.1
systemd-mini-bash-completion-228-62.1

References:

https://www.suse.com/security/cve/CVE-2018-15686.html
https://www.suse.com/security/cve/CVE-2018-15688.html
https://bugzilla.suse.com/1106923
https://bugzilla.suse.com/1108835
https://bugzilla.suse.com/1109252
https://bugzilla.suse.com/1110445
https://bugzilla.suse.com/1111278
https://bugzilla.suse.com/1112024
https://bugzilla.suse.com/1113083
https://bugzilla.suse.com/1113632
https://bugzilla.suse.com/1113665


To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org
For additional commands, e-mail: opensuse-security-announce+help@opensuse.org

Top
More in Preporuke
Sigurnosni nedostaci programske biblioteke libxkbcommon

Otkriveni su sigurnosni nedostaci programske biblioteke libxkbcommon za operacijski sustav openSUSE. Otkriveni nedostaci potencijalnim napadačima omogućuju izazivanje DoS stanja. Savjetuje...

Close